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DETAILED ACTION 

1 . This is in response to the annendment and Response filed on 3/30/3005. Claims 
1-7 and 9-21 are presented for examination. 

Claim Rejections - 35 USC § 103 

2. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed 
or described as set forth in section 102 of this title, if the differences between the 
subject matter sought to be patented and the prior art are such that the subject matter 
as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall 
not be negatived by the manner in which the invention was made. 

This application currently names joint inventors. In considering patentability of the 

claims under 35 U.S.C. 103(a), the examiner presumes that the subject matter of the 
various claims was commonly owned at the time any inventions covered therein were 
made absent any evidence to the contrary. Applicant is advised of the obligation under 
37 CFR 1 .56 to point out the inventor and invention dates of each claim that was not 
commonly owned at the time a later invention was made in order for the examiner to 
consider the applicability of 35 U.S.C. 103(c) and potential 35 U.S.C. 102(f) or (g) prior 
art under 35 U.S.C. 103(a). 



3. Claims 1-4, 6, 7, 9-15, 17 and 19-21 are rejected under 35 U.S.C. 102(e) as 
being unpatentable over Freun US pat. No.5,987,61 1 (hereafter Freund) in view 
of He et al., US pat. No.6,088,451 , 
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As to claim 1 , Freund discloses a method for accessing one of a plurality of 
remote service providers (web server 350's of fig. SB can be Internet Service providers) 
across a network via a single login to a host service provider (320a fig.3B), each of the 
plurality of remote service providers being accessible through the host service provider, 
and each of the plurality service providers having separate login procedures requiring 
data comprising the steps of: 

the host service provider (320a fig.3B) receiving the single login (providing 
remote login from clients 310's fig.3A), the host service provider (see abstract, fig.3B, 
col.21 line 47 to col.22 line 21). 

a universal session manager (373 fig.3B) retrieving data from a validation 
database (374 fig.3B) based on the single login, wherein the data is effective for 
accessing a remote service provider and is based at least in part on the received 
username and password (i.e., monitoring user access, col.22 line 23 to col. 23 line 55). 

Freund does not disclose transmitting data to the remote service provider and 
directing the user to the remote service provider after the remote service provider 
exchanging the data to effect a two-sided authentication and the host service provider 
directing the user to the remote service provider. However, He discloses transmitting 
data to the remote service provider and directing the user to the remote service provider 
after the remote service provider exchanging the data to effect a two-sided 
authentication and the host service provider (credential server 204 fig.2) for directing the 
user to the remote service provider (using credential server 204 to manage user 
credentials with authentication server 202, see fig.2, abstract, see col.1 1 line 54 to 
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col. 12 line 33 and col. 12 line 65 to col. 13 line 63). It would have been obvious to one of 
the ordinary skill in the art at the time the invention was made to implement He's 
teachings into the computer system of Freund to control network access because it 
would have relieved the administrative burden to effectively and efficiently control and 
manage user credentials and thus enabled the enhanced the effectiveness of the 
access control mechanisms 

As to claims 2 and 10, Freund discloses a trusted service module (372 fig.3B) acts as 
an intermediary between the host service provider and the trusted service provider (i.e., 
a secure session transaction with the servers 350's fig.3B, seecol.22 lines 1-59). 

As to claim 3, Freund discloses receiving the session ID from the trusted service 
provider (see figs.7A-B, col.24 lines 16-63 and col.25 lines 14-51). 

As to claims 4, 6 and 9, Freund discloses placing a text file on the user's network data 
acquisition module and registering the user with the remote service provider 
(establishing user-define group, see col.25 line 14 to col.26 line 50). 

As to claim 7, Freund further discloses a method for accessing one of a plurality of 
remote service providers across a network via a single login to a host service provider 
(320a fig.3B) each of the plurality of remote service providers (350's fig.3B) being 
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accessible through the host service provider, and each of the plurality service providers 
having separate login procedures requiring data comprising: 

a user system having a network data acquisition module and plurality of remote 
service providers (350's fig.3B) (see abstract, fig.SB, col. 21 line 47 to col.22 line 21 ). 

a universal session manager (373 fig.3B) for receiving a user's ID and password 
(identification code and password, see col. 13 lines 1-31) and passing data required for 
access to said remote service provider and a validation database (374 fig.3B) for storing 
information for accessing the remote service provider (using authentication server 371 
fig.3B for checking client/user ID and password, see col.22 lines 1-59). 

Freund does not disclose transmitting data to the remote service provider and 
directing the user to the remote service provider after the remote service provider 
exchanging the data to effect a two-sided authentication and the host service provider 
directing the user to the selected one of remote service providers. However, He 
discloses transmitting data to the remote service provider and directing the user to the 
remote service provider after the remote service provider exchanging the data to effect 
a two-sided authentication and the host service provider (credential server 204 fig.2) for 
directing the user to the selected one of remote service providers (using credential 
server 204 to manage user credentials with authentication server 202, see fig.2, 
abstract, see col.1 1 line 54 to col. 12 line 33 and col.12 line 65 to col. 13 line 63). It 
would have been obvious to one of the ordinary skill in the art at the time the invention 
was made to implement He's teachings into the computer system of Freund to control 
network access because it would have relieved the administrative burden to effectively 
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and efficiently control and nnanage user credentials and thus enabled the enhanced the 
effectiveness of the access control mechanisms 

As to claims 11, 13-15, Freund discloses a remote service provider with access 
requirements, registration module for receiving data to the services, a login module for 
gaining access the data for registering a user with the remote service provider 
(establishing and providing secure users' transactions, see col.22 lines 7-59 and col .24 
lines 16-63). 

As to claim 12, Freund discloses an Internet Browser (client application software 
includes a Web browser, see fig.2, col. 7 line 64 to col. 8 line 10). 

As to claim 17, Freund discloses the remote service provider is a distinct remote site 
from the host service provider (see fig.3B, col.21 line 57 to col.22 line 34). 

As to claims 19-21, Freund discloses the validation database transmitting data to the 
universal session manager indicating which service the user is enrolled (using database 
374 fig.3B for storing record of users) and the single login from the user is performed 
over a network (see fig.3B, col.21 line 57 to col.22 line 34 and col.24 lines 16-63). 

4. Claims 5, 16 and 18 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Freund and He and in view of Kirsch US pat. No.5,963,915. 
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Freund 's teachings still applied as in item 3 above. Freund does not 
specifically disclose a triple handshakes and a cookie. However, Kirsch discloses a 
triple handshakes and a cookie (i.e., providing a cookie and a series of handshake 
transactions to negotiate the establishment of the secure transactions between the 
servers, see col.2 lines 1-46 and col. 8 lines 12-63). It would have been obvious to one 
of the ordinary skill in the art at the time the invention was made to implement Kirsch's 
teachings into the computer system of Freund to process data transaction over the 
Internet because it would have provided automatic simultaneous purchase transactions 
handling for both secure and insecure client browsers and increased levels of 
authentication of data communications in the Internet. 

Response to Arguments 

5. Applicant's arguments with respect to claims 1-7 and 9-21 have been considered 
but are moot in view of the new ground(s) of rejection. 

Other prior art cited 

6. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

a. Brezak et al, US pat. No.6,401 ,21 1 . 
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Conclusion 



7. Claims 1-7 and 9-21 are rejected. 

8. Any inquiry concerning ttiis communication or earlier communications from the 
examiner should be directed to Khanh Dinh whose telephone number is (571) 
272-3936. The examiner can normally be reached on Monday through Friday 
from 8:00 A.m. to 5:00 P.m. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Zarni Maung, can be reached on (571) 272-3939. The fax phone number 
for this group is (703) 872-9306. 

Infornriation regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for published 
applications may be obtained from either Private PAIR or Public PAIR. Status 
information for unpublished applications is available through Private PAIR only. For 
more information about the PAIR system, see http://pair-direct.uspto.gov. Should you 
have questions on access to the Private PAIR system, contact the Electronic Business 
Center (EBC) at 866-21 7-91 97 (toll-free). 




Khanh Dinh 
Patent Examiner 
Art Unit 2151 
6/11/2005 



